StackRadar

CVE-2026-40895

Medium

Advisory

Published 14 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
0.005
40th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
352
of 17,787 indexed, latest versions
Container images
344
deployed by those charts
Fix available
1 of 1
affected package

follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets

Carried by container images the latest versions of 352 of 17,787 indexed charts deploy, on 344 images.

Affected packageAffected versionsFixed inImages
follow-redirectsnpm1.0.0, 1.2.5, 1.5.10, 1.6.1+26 more1.16.0344
OSV records
GHSA-r4q5-vmmm-2653

Charts affected

352 by stars
ChartLatestAffected imagesRadar Score
skoonerxdVerified publisher1.1.01 of 1See more

skooner xd 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-40895.

Container imageDigestPackageFixed in
ymuski/skooner:latest67819ca511b5
follow-redirects@1.14.8
1.16.0

Open the chart page →

1,752
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-40895.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.18.00ecd8444add2
follow-redirects@1.15.6
1.16.0

Open the chart page →

9,381

Container images carrying it

344 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/data-fair/simple-directory:438a4f32fad82
follow-redirects@1.14.9
1.16.0
1
ghcr.io/drewburr-labs/evobot:3.0.04ddbb244c82f
follow-redirects@1.15.2
1.16.0
1
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
follow-redirects@1.15.9
1.16.0
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
follow-redirects@1.15.11
1.16.0
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
follow-redirects@1.15.11
1.16.0
1
ghcr.io/hiteshnayak305/cors-proxy:1.2.0e6ff0a131556
follow-redirects@1.15.11
1.16.0
1
ghcr.io/huscker/townsquare-backend:2.15.2e106681e7673
follow-redirects@1.15.3
1.16.0
1
ghcr.io/jens-maus/raspberrymatic:3.83.6.202508244b22b4f407c4
follow-redirects@1.15.11
1.16.0
1
ghcr.io/linuxserver/raneto:version-0.16.6ef768f3df5d0
follow-redirects@1.13.2
1.16.0
1
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
follow-redirects@1.13.3
1.16.0
1
ghcr.io/m9sweeper/dash:1.6.02e27cdff8344
follow-redirects@1.15.5
1.16.0
1
ghcr.io/maastrichtu-ids/rstudio:latest981aa4c109e1
follow-redirects@1.15.6
1.16.0
1
ghcr.io/mario-f/kubevis:v1.4.0763daf9caf8e
follow-redirects@1.14.1
1.16.0
1
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
follow-redirects@1.15.2
1.16.0
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
follow-redirects@1.15.6
1.16.0
1
ghcr.io/oznu/homebridge:2022-07-08ff2af53897e7
follow-redirects@1.15.1
1.16.0
1
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
follow-redirects@1.15.9
1.16.0
1
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
follow-redirects@1.15.2
1.16.0
1
ghcr.io/rodg/nodecg-base:latest31be4bf87070
follow-redirects@1.15.6
1.16.0
1
ghcr.io/sct/overseerr:1.26.1254d16af8f71
follow-redirects@1.13.0
1.16.0
1
ghcr.io/sct/overseerr:1.35.06197516c9d7b
follow-redirects@1.15.2
1.16.0
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
follow-redirects@1.15.6
1.16.0
1
ghcr.io/wbstack/queryservice-gateway:2.2ab8e2f583e56
follow-redirects@1.9.0
1.16.0
1
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
follow-redirects@1.15.9
1.16.0
1
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
follow-redirects@1.15.9
1.16.0
1
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
follow-redirects@1.15.3
1.16.0
1
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
follow-redirects@1.15.3
1.16.0
1
public.ecr.aws/jtekt-corporation/time-series-storage-service:v1.5.1046ef5c9ed50
follow-redirects@1.15.3
1.16.0
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
follow-redirects@1.14.9
1.16.0
1
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
follow-redirects@1.7.0
1.16.0
1
quay.io/ibmgaragecloud/slack-notifications:latest041df93e2bac
follow-redirects@1.14.1
1.16.0
1
quay.io/jupyterhub/configurable-http-proxy:5.1.0eb10d5bf045c
follow-redirects@1.15.9
1.16.0
1
quay.io/mittwald/kube-mail:latest04f1099241fc
follow-redirects@1.15.9
1.16.0
1
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
follow-redirects@1.14.5
1.16.0
1
quay.io/netwarps/blockscoutbecd3e39360a
follow-redirects@1.14.8
1.16.0
1
quay.io/netwarps/walletconnect-relay:v2.1.3-rc.15d90b9c193e0
follow-redirects@1.15.1
1.16.0
1
quay.io/soketi/k8soketi:0.1-18-debian4cd9ea9434c4
follow-redirects@1.15.2
1.16.0
1
quay.io/soketi/pws:0.8-16-alpine399d2e6b10ef
follow-redirects@1.14.4
1.16.0
1
quay.io/soketi/soketi:1.6-16-debian713223456cf1
follow-redirects@1.15.2
1.16.0
1
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
follow-redirects@1.15.9
1.16.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
follow-redirects@1.15.11
1.16.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
follow-redirects@1.15.9
1.16.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user:1.0.31d8a9cd4e1ae3
follow-redirects@1.15.11
1.16.0
1
registry.gitlab.com/infinitydon/registry/open5gs-webui:v2.2.2fda21b0a0344
follow-redirects@1.2.5
1.16.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.